What this actually is.
Technical background, root cause, and affected surface.
JmsBinding.extractBodyFromJms() in camel-jms, camel-sjms, camel-sjms2, and camel-amqp deserializes JMS ObjectMessage payloads via javax.jms.ObjectMessage.getObject() without ObjectInputFilter, class allowlist, or denylist. When mapJmsMessage is enabled (default), any JMS producer can trigger arbitrary code execution on the Camel consumer.
- Vendor
- Apache
- Product
- Apache Camel
- Severity
- Critical
- CVSS Score
- 9.8
- Status
- Published
- CWE
- CWE-502: Deserialization of Untrusted Data
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
JmsBinding.java: extractBodyFromJms() -> objectMessage.getObject() -> ObjectInputStream.readObject() (no filter); mapJmsMessage=true by default exposes all JMS consumers
Root cause: ObjectInputStream deserialization of JMS ObjectMessage payload without ObjectInputFilter, class allowlist, or denylist
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker who can produce JMS ObjectMessage to any queue or topic consumed by a Camel route using camel-jms, camel-sjms, camel-sjms2, or camel-amqp with default mapJmsMessage=true configuration
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Arbitrary code execution on the Camel consumer host; potential full system compromise; data exfiltration from all systems accessible from Camel host
C:H · I:H · A:H
CWE-502: Deserialization of Untrusted Data
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Apache Camel 4.14.7, 4.18.2, or 4.20.0 which apply ObjectInputFilter. As immediate mitigation, set mapJmsMessage=false. Restrict JMS broker access to authenticated and trusted producers.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
CVE published
Fix released in Camel 4.14.7, 4.18.2, 4.20.0
Disclosed 0 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.